NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params

[jmurret]

Description

PR Discussion: https://github.com/hashicorp/consul-enterprise/pull/6760#discussion_r1319233169

TODO in code: https://github.com/hashicorp/consul/blob/main/agent/consul/leader_connect_ca.go#L1459

AuthorizeAndSignCertificate is called from two places and both resolve the authorizer from the token. So, we can utilize IdentityWriteAllowed which will pass in the authorizer based on the token to achieve Check for identity:write on the token when identity permissions are supported.

• consul/agent/grpc-external/services/connectca/sign.go

  Lines 71 to 76 in 21ea527

  	authz, err := s.ACLResolver.ResolveTokenAndDefaultMeta(options.Token, nil, nil)
  	if err != nil {
  	return nil, status.Error(codes.Unauthenticated, err.Error())
  	}
  	cert, err := s.CAManager.AuthorizeAndSignCertificate(csr, authz)

• consul/agent/consul/connect_ca_endpoint.go

  Lines 155 to 161 in 21ea527

  	authz, err := s.srv.ResolveToken(args.Token)
  	if err != nil {
  	return err
  	}
  	cert, err := s.srv.caManager.AuthorizeAndSignCertificate(csr, authz)
  	if err != nil {

Acceptance Criteria:

• check that we have identity:write on the token when the system signs a leaf certificate for the service or agent identified by the SPIFFE ID in the given CSR's SAN. It performs authorization.
• enforce identity:write in xds server
• enforce identity:write in getEnvoyBootstrapParams
• when identity:write permission is not available on the token, return an Permission denied error.

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

2 Ignored Deployments

Name	Status	Preview	Comments	Updated (UTC)
consul	⬜️ Ignored (Inspect)	Visit Preview		Oct 3, 2023 9:43pm
consul-ui-staging	⬜️ Ignored (Inspect)	Visit Preview		Oct 3, 2023 9:43pm

[zalimeni]

LGTM, AFAICT this is identical to previously reviewed Ent changes +/- one whitespace diff.

[zalimeni]

~ Looks like maybe discrepancy between Ent and this change due to whitespace, which may also be impacting the linter errors?

[jmurret]

yes. thanks. something got off with my commits and the script did not work, so I had to generate this by hand. I will fix. Thanks for pointing this out!